TR Forums

Guys... any idea how to tell who's logged into a gmail account on a network where the end users aren't on a domain?

I'm posting this in Linux because I have an EdgeRouter by Ubiquiti and it's running a Vyatta fork on a Debian base. So thought MAYBE someone might be able to help from the angle. Thanks!

As in who is using a particular gmail account or just identifying traffic that's going to gmail servers [which is all HTTPS anyway]?

The first. Attach an IP/MAC to a gmail user.

I'm confused - if you're sniffing network traffic, it's encrypted, and probably a no-go.

If you're logged into the account and want to see who else is logged into that same account, doesn't Google already have something for that? https://support.google.com/mail/answer/45938?hl=en

Yeah, this would be sniffing. I was hoping SOME part of it was plaintext, but I realize that's way too hopeful.

Yeah the entire session is encrypted, so the best you're going to do is see which LAN machines are accessing gmail.com.

SuperSpy wrote:

Yeah the entire session is encrypted, so the best you're going to do is see which LAN machines are accessing gmail.com.

The only way you could conceivably do this is by installing something like a Blue Coat web proxy between the internal network and the internet, and requiring all users on the network to use browsers which have been pre-configured with the proxy's security certificate (to prevent the users from getting security certificate warnings). This is how corporate IT departments that want to spy on all network usage of their employees do it.

As SuperSpy notes, without the ability to peer into the HTTPS packets the most you'll be able to do is identify which internal MAC/IP addresses are accessing Gmail.

Yeah, I was reading up on using a certificate proxy. NOT going there. Screw that.

|FN|Steel wrote:

Yeah, this would be sniffing. I was hoping SOME part of it was plaintext, but I realize that's way too hopeful.

I don't hope that, and you shouldn't either.

DancinJack wrote:

|FN|Steel wrote:

Yeah, this would be sniffing. I was hoping SOME part of it was plaintext, but I realize that's way too hopeful.

I don't hope that, and you shouldn't either.

Only in the context of THIS situation, but yeah, I understand.

We had a disgruntled employee setup a gmail account and send an e-mail to everyone in the company from it. I'd love to be able to nail the ****.

This may not be practical if there are many employees or if bcc was used - are you able to parse the To list and see who was not included? Or look in the inboxes that corporate does control?

JBI beat me to it. Blue Coat is the way to go. Blue Coat can also block access to gmail.

tanker27 wrote:

JBI beat me to it. Blue Coat is the way to go. Blue Coat can also block access to gmail.

I should add, I am not a fan of this sort of thing, and my mentioning it should not be considered an endorsement. It creates a huge potential single point of security failure, which can compromise all HTTPS traffic in/out of a network. Furthermore, for organizations which do software development, it causes problems for people who may have a legitimate need to run OSes or browsers other than the ones pre-configured by IT.

just brew it! wrote:

tanker27 wrote:

JBI beat me to it. Blue Coat is the way to go. Blue Coat can also block access to gmail.

I should add, I am not a fan of this sort of thing, and my mentioning it should not be considered an endorsement. It creates a huge potential single point of security failure, which can compromise all HTTPS traffic in/out of a network. Furthermore, for organizations which do software development, it causes problems for people who may have a legitimate need to run OSes or browsers other than the ones pre-configured by IT.

Yeah I'm not a fan. It was painful when first implemented here. A lot of things were blocked that I use on a daily basis (I am in Software development). And I got tired of my emails back an forth trying to (Nazi IT Sec) get things whitelisted. However, since then they've built an autonomous whitelist workflow/feature where my manager signs off and I get instant access. It's really not so bad now. It blocks a lot; social media/network, cloud based email (gmail Yahoo, et al), of course nsfw websites, youtube, etc. etc.

Personally I have exception to Social stuff and Youtube because of what I do I need the access.

tanker27 wrote:

Personally I have exception to Social stuff and Youtube because of what I do I need the access.

Been there, done that. My middle school blocked youtube - and the teachers complained because there are instructional videos on there.

Personally, I keep stuff like Facebook or forums off the corporate computer. I usually have my phone and/or laptop with me anyway.

Small company in charge of it all is rather nice. I have access to all the things and know exactly what's being used to track things accessed (nothing)!

I managed to figure out who it was. We're small enough that the suspect list was relegated to a small clique of employees. One of those employees had cleared their web history, gmails, and Skype history right around the same time the email was sent. Circumstantial for sure. So I pulled chat logs from someone they talked to regularly and in that conversation they used almost exactly the same phrase used in the email that got sent out and it was specific enough that there's no chance it was a coincidence.

Next up, internal IM replacement! Anyone have any experience with Openfire?

Was just going to suggest that if you start doing a password reset on the account in question and the miscreant added their mobile number to the account Google will tell you the last 3 digits of their number which might have been enough for you to finger them. Probably wouldn't have worked since you'd have to be really stupid to do that under these circumstances.